minor enhancement: added robustness for setres[gu]id function calls

4 files changed, 10 insertions, 17 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index a9af46b6f..ece4c2cb5 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -866,11 +866,9 @@ static void run_builder(int argc, char **argv) {
         (void) argc;
 
         // drop privileges
-        gid_t gid = getgid();
-        uid_t uid = getuid();
-        if (setresgid(gid, gid, gid) != 0)
+        if (setresgid(-1, getgid(), getgid()) != 0)
                 errExit("setresgid");
-        if (setresuid(uid, uid, uid) != 0)
+        if (setresuid(-1, getuid(), getuid()) != 0)
                 errExit("setresuid");
 
         assert(getenv("LD_PRELOAD") == NULL);
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 096f34cc5..dca36a4d8 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -162,11 +162,9 @@ int check_kernel_procs(void) {
 void run_no_sandbox(int argc, char **argv) {
         EUID_ASSERT();
         // drop privileges
-        gid_t gid = getgid();
-        uid_t uid = getuid();
-        if (setresgid(gid, gid, gid) != 0)
+        if (setresgid(-1, getgid(), getgid()) != 0)
                 errExit("setresgid");
-        if (setresuid(uid, uid, uid) != 0)
+        if (setresuid(-1, getuid(), getuid()) != 0)
                 errExit("setresuid");
 
         // process limited subset of options
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c
index e10f90850..a63f29322 100644
--- a/src/firejail/run_symlink.c
+++ b/src/firejail/run_symlink.c
@@ -34,11 +34,9 @@ void run_symlink(int argc, char **argv, int run_as_is) {
                 return;
 
         // drop privileges
-        gid_t gid = getgid();
-        uid_t uid = getuid();
-        if (setresgid(gid, gid, gid) != 0)
+        if (setresgid(-1, getgid(), getgid()) != 0)
                 errExit("setresgid");
-        if (setresuid(uid, uid, uid) != 0)
+        if (setresuid(-1, getuid(), getuid()) != 0)
                 errExit("setresuid");
 
         // find the real program by looking in PATH
@@ -95,7 +93,7 @@ void run_symlink(int argc, char **argv, int run_as_is) {
         umask(orig_umask);
 
         // desktop integration is not supported for root user; instead, the original program is started
-        if (uid == 0 || run_as_is) {
+        if (getuid() == 0 || run_as_is) {
                 argv[0] = program;
                 execv(program, argv);
                 exit(1);
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 52f0f89c5..46b392eed 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -120,9 +120,8 @@ clean_all:
 // - for root group or if nogroups is set, supplementary groups are not configured
 void drop_privs(int nogroups) {
         gid_t gid = getgid();
-        uid_t uid = getuid();
         if (arg_debug)
-                printf("Drop privileges: pid %d, uid %d, gid %d, nogroups %d\n",  getpid(), uid, gid, nogroups);
+                printf("Drop privileges: pid %d, uid %d, gid %d, nogroups %d\n",  getpid(), getuid(), gid, nogroups);
 
         // configure supplementary groups
         EUID_ROOT();
@@ -136,9 +135,9 @@ void drop_privs(int nogroups) {
                 clean_supplementary_groups(gid);
 
         // set uid/gid
-        if (setresgid(gid, gid, gid) != 0)
+        if (setresgid(-1, getgid(), getgid()) != 0)
                 errExit("setresgid");
-        if (setresuid(uid, uid, uid) != 0)
+        if (setresuid(-1, getuid(), getuid()) != 0)
                 errExit("setresuid");
 }